How to Fill Out a Release of Information Form: Sections and Signatures

To fill out a Release of Information form correctly, complete every required field the HIPAA Privacy Rule expects on a valid authorization: your identifying details, the name of the provider holding the records, the person or organization receiving them, a specific description of the records and date range, the purpose of the disclosure, an expiration date or event, and your signed, dated signature. A form missing any of these core elements is defective, and a provider should not process it.¹ Get those pieces right the first time and the rest is straightforward.

Gather Your Information Before You Start

Pulling everything together before you open the form cuts down on errors and rewrites. You will need:

Your full legal name (exactly as it appears in the record holder’s system), date of birth, current address, phone number, and any identifier the record holder uses, such as a patient ID or policy number.
Full contact information for the recipient: name, mailing address, phone, and fax or email. If the recipient is an organization, name a specific department or person so the records don’t sit in a general mailbox.
A clear description of the records you want released and the date range they cover.
The reason for the release. Common ones are continuity of care, an insurance claim, legal proceedings, disability determination, or a personal copy.
An expiration date or event. The authorization has to have an endpoint.²

Work Through Each Section of the Form

Most ROI forms follow the same general layout regardless of the provider.

Your Personal Information

Enter your full legal name exactly as the record holder has it. Include date of birth, current address, and phone number. If the form asks for a patient ID or other identifier, fill it in. This helps the records department find the right file, especially if you have a common name.

Recipient Information

Write the complete name and contact details of whoever will receive the records. Double-check the mailing address and fax number. A transposed digit sends your health information to the wrong place. If you are sending records to a specific physician within a larger practice, include both the physician’s name and the practice name.

Description of Records and Date Range

Be as specific as the form allows. “All cardiology records from January 2024 through June 2025” processes faster and releases less unrelated information than checking a box for “entire medical record.” Narrow the request to what actually serves your purpose: specific visit notes, lab results, imaging reports, or discharge summaries within a defined date range.

Purpose of the Disclosure

Many forms give checkboxes for common purposes. If none fit, write in a specific explanation. If you initiated the authorization yourself and prefer not to explain, HIPAA accepts “at the request of the individual” as sufficient.¹

Expiration Date or Event

Choose a reasonable window. For a one-time transfer to a new doctor, 90 days is usually plenty. For an ongoing insurance claim, you can tie the expiration to the resolution of the claim. The authorization stays valid until the date or event you specify, unless you revoke it in writing before then.²

Statements the Form Itself Must Contain

Beyond the fields you complete, HIPAA requires the form to include three written statements. Check that they appear before you sign:

Notice of your right to revoke the authorization in writing, and how to do it.
A statement about whether the provider can condition treatment, payment, enrollment, or benefits on your signing.
A warning that information disclosed under the authorization could be re-disclosed by the recipient and would no longer be protected by HIPAA.¹

If a form doesn’t explain your right to revoke, that is a red flag that it may not meet HIPAA’s requirements.³

Who Signs When It Isn’t You

In most cases, you sign your own authorization. There are exceptions when someone else has legal authority to sign on your behalf, and when a personal representative signs, the form must also describe that person’s authority to act (for example, “healthcare power of attorney executed on March 15, 2025”).¹

Parents and Guardians of Minors

For an unemancipated minor, a parent, guardian, or person acting in loco parentis with legal authority to make healthcare decisions generally serves as the child’s personal representative.⁴ HIPAA defers to state law here. Some states give minors independent control over certain records such as reproductive health, mental health, or substance use counseling, and for those specific records the parent may not automatically qualify as the personal representative.⁵

Adults Who Cannot Sign for Themselves

If an adult is incapacitated, HIPAA recognizes anyone authorized under state or other applicable law to make healthcare decisions for the individual, which typically includes a person holding a healthcare power of attorney or a court-appointed legal guardian.⁴

Records of a Deceased Individual

For a deceased person, the personal representative is whoever has legal authority to act on behalf of the decedent or the estate: an executor, an administrator, or in some cases next of kin if state law provides that authority.⁴

Sensitive Records That Need a Separate Form

Not all health information is treated equally. A standard release may not be enough for certain categories, and using the wrong form guarantees a rejection.

Psychotherapy Notes

Psychotherapy notes are the personal notes a therapist keeps separate from the rest of the medical record. A provider must get a separate, specific authorization before disclosing them for any purpose, including sharing them with another treating provider. An authorization for psychotherapy notes cannot be combined with an authorization for other health information on the same form.¹ Narrow exceptions exist for disclosures required by law, such as mandatory abuse reporting, or when a patient poses a serious and imminent threat.⁶

Substance Use Disorder Records

Records from federally assisted substance use disorder treatment programs are governed by 42 CFR Part 2, which layers extra consent requirements on top of HIPAA. A valid Part 2 consent must include your name, a specific description of the information, the recipient’s identity, the purpose, your right to revoke, an expiration date or event, and your signature and date. For SUD counseling notes specifically, the consent can only be combined with another consent for SUD counseling notes, not with a general medical records release. Providers cannot condition your treatment on whether you consent to release SUD counseling notes.⁷

Signing and Submitting

Read every field one more time before signing. The most common rejection reasons are a missing signature date, a missing or expired expiration date, and a vague records description. If a witness signature line appears, ask whether it is required; some organizations include it as extra verification and others leave it optional.

You do not have to print, sign in ink, and scan. HIPAA authorizations can be completed and signed electronically. The federal E-Sign Act establishes that a signature cannot be denied legal effect solely because it is in electronic form, and methods such as typed name-and-password combinations, biometric verification, and digital signature platforms can all qualify.⁸ Many providers now offer portal-based forms that handle this automatically. If a provider still works primarily on paper, confirm they accept electronic signatures before completing the form digitally.

Submit through whatever method the recipient accepts: mail, fax, scanned email attachment, or a patient portal upload. Confirm the preferred method in advance so your form doesn’t sit in an unmonitored inbox. Keep a copy of the signed form for your own records.

After You Submit

How Long the Provider Has to Respond

Once a provider receives your valid authorization, HIPAA gives them up to 30 calendar days to act on a request for access to your records. If they cannot meet that deadline, they may take up to an additional 30 days, but only if they notify you in writing within the initial 30-day window explaining the delay and giving a completion date.⁹ If a legal deadline or claim depends on the records, submit well in advance.

Fees for Copies

Providers can charge for copying and mailing, but the fees are regulated. For electronic copies of records maintained electronically, HIPAA allows a flat fee option of no more than $6.50 per request, covering labor, supplies, and postage. Alternatively, the provider may calculate actual costs or use a schedule based on average labor costs.¹⁰ Per-page fees for paper copies vary by state and can range from roughly $0.25 to over $1.00 per page, sometimes with higher rates for the first batch. Electronic copies are almost always cheaper.

Revoking Your Authorization

You can take back an authorization at any time by submitting a written revocation to the provider that holds your records. It takes effect when the provider receives it, not when you mail it.³

Two limits apply. Revocation cannot undo disclosures the provider already made while the authorization was valid. And if you signed the authorization as a condition of obtaining insurance coverage, the insurer may retain the right to contest a claim or the policy itself even after you revoke.³

If You’re Releasing School Records Instead

Everything above applies to medical records under HIPAA. If you are releasing education records rather than health information, the Family Educational Rights and Privacy Act governs and the school will use its own consent form. A valid FERPA consent must be signed and dated, identify the specific records, state the purpose of the disclosure, and name the party or class of parties who will receive the records; oral consent does not count. For students under 18 a parent or guardian signs, and once a student turns 18 or enrolls in a postsecondary institution the rights transfer to the student.¹¹¹²

1
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
2
HHS.gov. Must an Authorization Include an Expiration Date
3
HHS.gov. Can an Individual Revoke His or Her Authorization
4
HHS.gov. Personal Representatives
5
HHS.gov. Personal Representatives and Minors
6
HHS.gov. HIPAA Privacy Rule and Sharing Information Related to Mental Health
7
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
8
HHS.gov. Use of Electronic Informed Consent Questions and Answers
9
HHS.gov. How Timely Must a Covered Entity Be in Responding to Individuals
10
HHS.gov. Is 6.50 the Maximum Amount That Can Be Charged
11
eCFR. 34 CFR 99.30 – Under What Conditions Is Prior Consent Required to Disclose Information
12
U.S. Department of Education. What Must a Consent to Disclose Education Records Contain